I believe that JSESSIONID cookie will appear after successful login. You could try recording your traffic from web browser with a sniffer tool like Fiddler or Wireshark or whatever and compare what's being sent with a browser with the request from JMeter.
My expectation is that you're missing some login request mandatory value. You could try look into source code of your login page to see if there is anything similar to
<input type="hidden"..>
I guess that you're missing something like "viewstate" in your login request and that's why it's being rejected.
If my guess is correct you could use JMeter Regular Expression Extractor Post Processor to fetch dynamic values from page source and provide them in following requests.
For example if you have the following input:
<input type="hidden" name="javax.faces.ViewState" id="javax.faces.ViewState" value="1ffVEvtAxEXyO+Mq561c58UaygSCfODTuKhiyBB7MATW+QQhvdmMhqtAU1AZey37+ZBtxx0Q0XfMl3v02hurmowb+bbxZHpBEJzcLPfE+e1ESTuA6mT6IUn5xH8=" />
You should be able to extract this value with RegEx like:
<input type="hidden" name="javax.faces.ViewState" id="(.+?)" />
The good place to test your regular expressions is Jakarta Oro Demonstration Applet